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Abstract 


The resurgence of interest in the use of nuclear technology for electrical power production 
has resulted in a desire to improve the existing licensing structure. Improving the licensing 
structure will result in reduced design time and cost for new reactor plants. An improved 
regulatory process is also necessary in order to license advanced reactors that are not light 
water technology. Risk based reactor licensing, which uses the Probabilistic Risk 
Assessment (PRA) to justify most licensing questions, is a proposed replacement for the 
current methods. 

This work further develops the risk-based regulatory process by analyzing a portion of a 
new reactor concept. A reactor similar to the Pebble Bed Modular Reactor (PBMR) is the 
design chosen for the analyses. The designers of the PBMR assert that the reactor’s 
inherently safe design justifies the use of a non-standard containment system. This 
assertion can be treated as a design question to be justified using the risk-based approach. 
The effect of the changing the containment system is incorporated into the PRA for the 
PBMR. 

The contributions to the event and fault trees of the PBMR are determined for two 
casualties that affect the plants decay heat removal system. The initiating event for both of 
these casualties is assumed to be a beyond design basis earthquake. 

The first casualty is steam blanketing of the reactor vessel due to a rupture in the Reactor 
Cavity Cooling System (RCCS). This casualty is shown to have little effect on the safety 
of the plant. The second casualty was failure of the RCCS due to operator inaction. If this 
casualty were to occur the reactor vessel has the possibility of failing catastrophically. The 
failure of the reactor vessel could result in damage to the fuel and release of radionuclides. 
The probability of this casualty resulting in a significant release of radionuclides is 
7.5-10 ■" / year. For the two casualties evaluated in this work, the use of a non-standard 
containment is justified. 
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Chapter 1 Goal and Outline for this Work 


This chapter states the goal and the problem statement for this work. Then the 
motivation behind the goal and the plan for this work are discussed. An outline of this 
work is also provided for understanding the scope of the project. 

1.1 Goal for this Work 

The Nuclear Regulatory Commission (NRC) is interested in improving the means by 
which reactor plants are designed and licensed. Risk-Based goals and requirements have 
been given serious attention due the advances made in Probabilistic Risk Assessment 
(PRA) techniques. The NRC has sponsored a project to determine if it is possible to use a 
risk based approach for licensing nuclear reactors. This Risk-Based approach uses the 
PRA as the primary measure of reactor safety. Developing a new means of licensing 
reactors is particularly important when considering reactor types that are not based on light 
water reactor technology. Any improved licensing method must be able to be applied to 
advanced reactor types in order for it to be of use by both the Nuclear Regulatory 
Commission and the nuclear reactor designers. 

Analyzing the safety of a reactor design is a large task. This is an even greater 
problem when the reactor is different from those for which there is past experience. There 
are three goals for this work. The first goal is to identify casualties specific to the Pebble 
Bed Modular Reactor. The second goal is to perform the deterministic analysis on these 
casualties to determine any possible effects on reactor safety. Finally, probabilities are 
assigned to any outcomes for use in a Risk-Based analysis of the Pebble Bed Modular 
Reactor. 

1.2 Problem Statement 

An improved licensing method must allow for the development and construction of 
new reactor types in the United States. Risk-Based Safety Regulation is a possible method 
by which advances in reactor technology can be incorporated into the United States nuclear 
industry. In an effort to prove the viability of the integrated probabilistic approach this 






work attempts to use Risk-Based methods to analyze a gas cooled reactor. Eskom, a 
South African utility company, is designing an advanced gas cooled reactor called the 
Pebble Bed Modular Reactor (PBMR). This reactor is designed to be inherently safe. The 
designers of PBMR state that a standard containment system is unnecessary to ensure the 
protection of the public due to the reactor’s safe design. This work will explore the 
validity of this claim using the risk-based approach. The response of the reactor will be 
analyzed for two casualties that affect its decay heat removal capability. 

1.3 Motivation and Plan for this work 

The United States nuclear industry has been bogged down since the incident at 
Three Mile Island. An adversarial relationship has arisen between the Nuclear Regulatory 
Commission and the nuclear industry. Designers are sometimes hard pressed to justify 
some portions of their reactor designs to the NRC. Reactor designers and NRC officials 
sometimes cannot agree on the requirements. These disagreements result in longer 
certification times and addition of unnecessary redundancy in some instances, both of 
which lead to increasing the cost of the reactor plant. This research is being conducted on 
behalf of the NRC. 

The improved licensing structure will use the Probabilistic Risk Assessment (PRA) 
as the primary means of certification. Currently, the PRA is used to justify design . 
decisions. In the improved licensing structure the NRC will specify PRA standards for 
various events. Then the engineers will have specific safety goals to meet while designing 
the reactor plant. When the PRA is completed, all uncertainty in the analysis will be 
addressed with additional testing, defense in depth, and increased safety factors. When the 
time comes to have the NRC review the design, the engineers will only have to justify their 
PRA calculations and their handling of the uncertainty. The approval process should thus 
be made less adversarial. 

A Light Water Reactor (LWR) has previously been analyzed using the integrated 
probabilistic approach. There is a large amount of data available relating to LWR. The 
analysis proved that an integrated probabilistic method could be a useful tool. But in order 
for the method to be of real benefit it must be able to be applied to advanced reactor types. 







There is very little experience and data associated with advanced reactors in the United 
States. A new licensing structure must be able to be applied to these designs. In this work, 
the contributions to the event and fault trees for a portion of a new reactor concept are 
determined. A reactor similar to the PBMR is the design evaluated in this work. 

The PBMR will be analyzed using the risk-based analysis method. First, the 
overall design is evaluated for it’s response to a large earthquake. Then the possible 
casualties that could result in fission product release to the environment are discussed. 
Next, two casualties are chosen for in-depth analysis. Then, the effect of this casualty on 
the reactor containment is evaluated. Finally, probabilities and uncertainties will be 
assigned to the various aspects of the casualty in order for them to be incorporated into the 
PRA of the PBMR to help determine if a standardized containment system is necessary. 

1.4 Report Outline 


Chapter 2 describes the procedure of reactor licensing using an integrated probabilistic 
approach. 

Chapter 3 is a description of the Pebble Bed Modular Reactor. This chapter includes a 
description of the systems and specifications. The relevant subsystems are also discussed. 

Chapter 4 is an analysis of the possible casualties that could lead to fission product release 
and a description of the problem that is used in this case study. 

Chapter 5 describes the methods by which the various analyses are performed. The finite 
element analysis program used to analyze the heat transfer of the PBMR is HEATING. 
This chapter explains how HEATING works. Then, the analysis model of the PBMR is 
described. Finally, the deterministic methods used for the heat transfer and structural 
response are described. 

Chapter 6 presents the results of the analysis. The results detail the effects the casualties 
have on the vessel temperature, core temperature, and structmal response. 

Chapter 7 is a discussion of how the deterministic results are related to the probability of 
fission product release. 

Chapter 8 presents the conclusions of this work and discusses further work necessary to 
complete the integrated probabilistic analysis of the PBMR. 






Chapter 2 Description of the Integrated Probabilistic 
Approach to Reactor Licensing 


This chapter discusses the problems with the current licensing structure. Then the 
goals for nuclear regulatory reform are stated. Finally, the method by which probabilistic 
analysis can be used to improve the licensing of nuclear reactors is discussed. The 
majority of the information in this chapter is based on a presentation given at the June 
2001 ACRS Workshop titled “A New Risk-Informed Design and Regulatory Process”[l]. 

2.1 Motivations for Regulatory Reform 

One of the primary motivations for reforming the regulatory system is that the 
enormous capital costs and financial uncertainties associated with licensing and 
constructing nuclear power plants have restricted U.S. utilities from ordering any Nuclear 
Power Plants (NPP) in the past two decades. In the deregulated electricity market, nuclear 
power plants are even less economically attractive because these start-up costs hinder the 
possibility of a timely return on investment. On the other hand, some socio-economic 
factors have simultaneously increased the appeal of nuclear power as a viable option for 
power production. Compared to the fossil fuels used by coal, gas turbine, and natural gas 
plants, nuclear fuels cost utilities far less per megawatt. This disparity in cost grows each 
day as fossil fuels become scarcer and more expensive. Additionally, nuclear power 
provides electricity without the immediate environmental impacts of fossil fuel-burning 
plants. The U.S. government has repeatedly voiced its concern over America’s growing 
dependence on foreign oil. Increasing electricity consumption, stricter air pollution 
standards and continuing unrest in the oil-rich Middle East has forced the U.S. to diversify 
its energy production profile [2]. The Department of Energy and power production 
industry have indicated that nuclear power will continue to play a vital role in the U.S. 
energy profile. In order to spur new NPP construction, the start-up costs for a NPP must 
be reduced, while still maintaining adequate public protection. 

Public opposition to nuclear power has by no means vanished but rather waned in 
the absence of high-profile safety incidents since Three-Mile Island. Environmental, 
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political, and economic turmoil surrounding fossil fuels has further drawn the spotlight of 
criticism away from nuclear power. Additionally, the commercial nuclear power industry 
boasts an excellent and well-documented safety record. As a result, the nuclear power 
industry argues that it often endures unjustified regulatory burden without significant or 
demonstrable safety benefit. Accordingly, the Nuclear Regulatory Conunission has 
aceelerated efforts to re-evaluate and reform those regulations governing the lieensing, 
construction, operation, and decommissioning of commercial nuclear power plants. The 
NRC hopes to reduce the enormous capital costs preventing utilities from building NPPs, 
while still adequately protecting the public from the unlikely, yet possible, dangers of 
nuelear power. Furthermore, the existing regulatory framework cannot accommodate 
some advanced light-water reactors (LWR) and non-LWR types currently being considered 
as new projects by utilities within the U.S., pending results from foreign projects. Thus, 
the U.S. urgently needs a new regulatory approaeh to licensing nuclear power plants. This 
improved regulatory framework must continue to ensure adequate public protection while 
reducing costs and providing guidance for the regulation of advaneed reactor types. 

2.2 Problems with the Current Regulatory Procedures 

The design and regulatory process that was employed traditionally and is stUl used 
today consisted of the following steps. First, the designer develops a plant design that both 
produces power reliably and operates safely. The designer uses high level regulatory 
criteria and policies as inputs. Next, the regulator reviews the design. The designer and 
regulator then engage in a dialog. This dialog involves specifying safety features, their 
performance criteria, and methods of design and analysis. Throughout this process the 
designer documents the design basis while the regulator documents the safety evaluation, 
policies established, and criteria for future reviews. 

Any reform of the regulatory proeess needs to help overcome the problems 
associated with the current structure. These problems are: 

• The certifieation process is extremely long. 

• Regulation is primarily concerned with deterministic calculations without explicit 
consideration for uncertainty. 
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• Regulatory decisions on specific issues are made in isolation, resulting in an 
inefficient and incoherent licensing structure. 

• Deterministic analysis combined with subjective judgment has led to the practice of 
layering on of redundant. 

This layering on of redundant systems is called defense in depth. This practice has 
been one of the primary means used to address regulators concerns. In some cases it is 
warranted, but in other cases unnecessarily drives up the construction and operating cost of 
plants. The goal of this work is to determine if it is possible to use a risk-informed design 
process to evaluate a portion of an advanced reactor design. 

2.3 Goals for Regulatory Reform 

The current regulatory policies have resulted in designers having difficulty getting 
a reactor certified when the design differs from those that have been previously certified. 
The result of these difficulties is a nuclear industry that has been unwilling to invest in 
advances in reactor design, even when design improvements could result in much safer 
operations. Light Water Reactors (LWR) have a great deal of technological inertia in the 
United States nuclear industry, due to the fact that all current requirements, test procedures, 
and manufacturing infrastructure are based on LWR. This technological inertia combined 
with inefficient regulatory structure has resulted in very slow progress in our nuclear 
industry. The Goals for regulatory reform are: 

• Create methods to assure consistency of nuclear power plant applicants and 
regulators in performance and goals for producing safe, economical power. 

• Change the adversarial nature of the current licensing structure. 

• Create a licensing structure that is adaptable for a wide range of reactor types. 

2.4 Description of Probabilistic Regulatory Approach 

In recent decades, the techniques of PR A have reached a level of maturity and 
acceptability justifying the extensive incorporation of PRA in any new regulatory 
philosophy. In essence, PRA calculates the frequeney (events per year) with which 






undesirable sequences of events will occur. Certain known combinations of low-level 
events (pipe breaks, valve failures, operator errors, etc) must occur in order to cause a 
given high-level event (core damage, radionuclide release, etc). The frequencies of high- 
level events can then be calculated using fault tree or event tree logic and the frequencies 
of low-level events. The frequencies of low-level events from historical data, traditional 
deterministic analyses, and expert opinion are calculated. Hence, PRA provides us with a 
manner for quantifying safety, rather that relying upon vague terminology such as ‘not 
safe’, ‘safe enough’ or ‘extremely safe’ [3]. 

The overall goal for safety and regulatory reform for the nuclear power industry 
should be to create methods to assure consistency of nuclear power applicants and 
regulators in performance/goals for producing safe, economical power plants. Successful 
electric power production is based on two key issues. First, the production of electrical 
power must be economically feasible; otherwise it will be replaced by another means of 
productions. Second, the power must be produced in a safe manner. Power production 
that poses a significant risk to the public or environment is not acceptable. Both of these 
issues must be accounted for in any design and regulatory procedures. 

The theory behind a risk informed design and regulatory process is that all 
regulatory decisions should be based on the informed beliefs of decision makers. These 
beliefs can and should be stated in a probabilistic format. The basic equation governing a 
probabilistic determination of an event with a given Probability Density Function (PDF) is: 

Probability (x<X<X-bdx) = f(x) dx (for a continuous distribution) 

The regulator acceptance criteria must reflect acceptable best-estimate performance 
expectations and uncertainties. Regulatory questions and acceptance criteria should also 
be stated within a probabilistic framework. This framework should be as comprehensive 
as possible [1]: 

• Utilize probabilistic and deterministic models and data where feasible. Use 

subjective judgment where these models are not feasible. 

• State all subjective judgments probabilistically and incorporate them into the PRA. 






• Require both license applicant and regulatory staff to justify their decisions 
explicitly. 

• Initiate resolution process to resolve applicant-regulator disagreements. 

The risk informed regulatory approach for nuclear power plant evaluation is 
performed probabilistically and is supported by deterministic analyses, tests, experience, 
and judgments at all conceptual stages of development. Safety results of defense-in-depth, 
performance margins, best-estimate performance, and subjective judgments are all 
incorporated into a comprehensive PRA. The PRA is used to state the evaluator’s beliefs 
concerning system performance. The level of detail of acceptance criteria becomes finer as 
the level of concept development increases. Figure 2.1 is a diagram of the Risk-Informed 
Design and Regulatory process. 

Current licensing structures require reactor designs to be proven safe for Design 
Basis Accidents (DBA). Unfortunately, these DBAs are based on Light Water Reactors 
(LWR) designs. When a reactor design differs greatly from the existing LWRs, some of 
the design basis accidents become irrelevant. Also, different reactors designs will have to 
be analyzed for casualties that do not apply for LWR. For example, a High-Temperature 
Gas Reactor (HTGR) is susceptible to a water ingress casualty which is meaningless for a 
LWR. A risk-informed licensing structure must be adaptable for various designs. 

Reference [1] provides a description of how to develop casualties for new reactor designs. 





# 



Figure 2.1 Risk-Informed Design and Regulatory Process 
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Chapter 3 Description of the Pebble Bed Modular 
Reactor 


The analysis of this work is performed using a reactor similar; but not identical to 
the PBMR. The major characteristics are the same for both the notional reactor and the 
actual PBMR. This chapter contains a description of the PBMR. First, a brief history of 
the pebble bed technology and how it came to used is given. Then the current reactor 
design is discussed. Finally, the support systems relevant to this work are described. The 
information provided in this chapter is extensive and additional information can be found 
in references [4, 5]. 

3.1 History of the Pebble Bed Reactor Type 

Eskom Ltd., the nation utility of South Africa currently has about 34,0(X)Mwe of 
generating capacity, primarily coal plants with some hydro power and two nuclear plants 
located in southwest South Africa near Cape Town. There is a growing demand for 
electrical power in the region. Eskom compared several alternatives for power generation 
and decided that LWR were too expensive. It was decided that coal fired power plants 
were not advantageous since the power demand is growing in the south and all of the coal 
is located in the north of the country. 

Eskom decided to use German pebble bed technology, which was an ultra-safe 
system, so they could concentrate on the economics of the system. Modular plants of a 
modest size were selected to take advantage of economical benefit of many identical 
systems. As power demand increases additional power units can be added. Eskom and 
their partners envision that the PBMR technology could be exported world-wide because 
of its safety and attractive economics. The partners in this venture British Nuclear Fuels 
(BNFL), Excelon, and Industrial Development Corporation of South Africa (IDC) [4, 5]. 
For further information on the PBMR please see the Eskom website. 







3.2 General Description of the Pebble Bed Modular Reactor 


The PBMR concept is based on German high temperature hehum cooled pebble 
bed reactor technology demonstrated at the AVR and THTR reactors. The PBMR is a 
modular, graphite moderated, helium cooled, pebble bed type reactor that uses a Brayton 
direct gas cycle to convert the heat into electrical energy by means of a helium turbo¬ 
generator. A regenerative heat exchanger, called a recuperator, is used to improve the 
thermodynamic efficiency. The PBMR plant specifications developed by Eskom are given 
below in Table 3.1 [5]. 

Table 3.1 PBMR Plant Specifications 


Maximum Power Output 

268 MW thermal 

Continuous Stable PoWer Range 

0-100% 

Anticipated Cost (nth module) 

$1000/KWe 

Construction Schedule 

24 Months 

Outage Rate 

2% planned & 3% forced 

O&M and Fuel Costs 

$4-5/MWHr 

Emergency Planning Zone 

< 400 meters 

Plant Operating Life Time 

40 years 

Maximum Operating Temperature 

900°C 

Maximum Operating Pressure 

7 MPa 


The PBMR has a large core with a low power density. The helium coolant remains 
in a gaseous phase and is inert. The layout of the PBMR reactor plant is shown in Figure 
3.1. The plant is a traditional closed gas cycle turbine system using a recuperator to 
improve the thermodynamic efficiency. The Power Control System varies the power of 
the reactor by changing the amount of helium in the system. 
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Figure 3.1 PBMR Plant Layout [ 5 ] 

3.3 Description of the Pebble Bed Reactor Fuel Design 

• 

One of the most important safety features of the PBMR is the fuel design. The 
PBMR uses spherical pebbles 60 mm in diameter, each impregnated with about 15,000 
^ enriched (8% U-235) uranium particles coated using the three-layer TRISO particles 

shown in Figure 3.2. These fuel particles can withstand very high temperatures prior to 
releasing fission products. The German test facility indicated that the fuel particles can 
withstand temperatures of about 1700 °C with no significant damage and up to 2200 °C 
® with damage limited to about 0.01% of the fuel. Figure 3.3 shows the results of the 

German tests of the TRISO fuel particles [5]. 
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Graphite Pebble impregnated with TRISO Fuel Particles as used in the PBMR 



Figure 3.2 PBMR Graphite Pebble and TRISO Fuel Particle 
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Figure 3.3 Results of TRISO Fuel Particle Tests [ 5 ] 








3.4 PBMR Core Description 


The PBMR core is 3.5 meters in diameter and 8.5 meters high. The core consists of 
two regions. The cylindrical inner region is filled with approximately 110,000 moderating 
balls which are only graphite. The fuel balls are housed in an annular region that 
surrounds the center reflector. There are approximately 336,000 pebbles in the fuel region. 
This arrangement flattens out the power distribution. About 5,000 pebbles are cycled 
through the core each day. They are monitored for fuel burnout; in order to determine if 
they should be sent back to the top of the core or to the spent fuel holding area. The core 
has a large negative temperature coefficient, which adds to its safety. 

The core is surrounded by a graphite reflector. The reactivity control and shutdown 
system consists of two subsystems. The primary means of reactivity control are control 
rods. These rods are fully inserted to shutdown the reactor. At power, the control rods 
primary purpose is to make up for xenon transients. The second subsystem is the Small 
Absorber Spheres (SAS), which are used as an emergency backup system. 

3.5 Overall Plant Layout and Containment System 

The plant wiU consist of a single building approximately 50 x 26 meters and 42 
meters in height, with 21 meters below ground level. The reactor will be contained in a 
citadel. The citadel will house the reactor inside the Reactor Cavity. The turbo¬ 
compressors and Power Turbine will be contained within Power Conversion Unit (PCU). 
Figure 3.4 is a side view of the PBMR building. This figure shows the positions of the 
Reactor Cavity and the PCU. The containment system is also shown in Figure 3.4. 

In the event of a large rupture in the reactor cavity, the containment system 
prevents over-pressurization by relieving pressure into the adjacent PCU. If pressure is 
still too high, lift plates in the rcU relieve pressure by venting citadel into the building. 

The building itself has pressure relief dampers that relieve excess pressure to the 
atmosphere. The sequential barriers posed by the containment system act to contain 
fission products first to citadel and then to the building. There is also a pressure relief 
shaft that has a rupture disk which actuates to protect the citadel from small to medium 
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size ruptures; it is equipped with a filtration system. Eskom analysis shows that this design 
in combination with the inherent safety of the PBMR design prevents the need for a 
standard containment system [5]. According to Eskom, the requirement of a standard 
containment system would make the PBMR economically unfeasible. 



Figure 3.4 Plant Layout and Containment System [ 5 ] 

3.6 Description of the Reactor Cavity 

The analysis portion of this work deals primarily with the casualty response of the 
PBMR. Proper modeling of the reactor cavity is very important for accurate response 
calculations. The reactor cavity contains several systems. For this casualty analysis the 
most important components to be modeled are the reactor and the Reactor Cavity Cooling 










System (RCCS). The reactor vessel is supported by mounts that allow for thermal 
expansion and contraction. The reactor is unlagged in belt region. This allows for heat to 
be removed from the reactor vessel via radiation and convection. In normal operation 
water circulates through the RCCS removing heat from the reactor cavity. The reactor and 
its attached subsystems are sometimes referred to as the Reactor Unit. 

Figure 3.5 is a cutaway view of the reactor cavity showing the location of the various 
components. This figure is based on data obtained from the PBMR Safety Analysis Report 
(SAR) [5]. The RCCS consists of 45 cylinders that are 22.5 meters tall. The system 
consists of three identical and independent subsystems. The RCCS is one the primary 
design features that makes the PBMR inherently safe. A more detailed description of the 
RCCS is included in Appendix A [5]. 

3.7 Cooling Systems 

Several cooling systems are required for proper operation of the PBMR. The 
ultimate heat sink for the initial PBMR test facility will be sea water. The sea water is 
distributed to the various other cooling systems via the Open Circuit Cooling System. 
Figure 3.6 shows the loads supplied by the Open Circuit Cooling System [5]. The backup 
cooling tower is used in emergency situations, where power is lost to the open circuit 
cooling pumps. 

The RCCS normally cooled by the open circuit cooling water. The backup cooling 
tower supplies flow to the RCCS when electrical power is lost to the open circuit cooling 
pumps. The pumps that circulate water to the backup cooling tower are powered from 
emergency diesel generators. In the event of a loss of all electrical power, the RCCS 
system is designed to boil off over time removing heat from the reactor cavity. The PBMR 
SAR states that there is enough water in the RCCS to keep the reactor cavity cool for three 
days without flow of circulating water. The RCCS can also be supplied by fire hoses, if 
electrical power is unavailable. The ability of RCCS to remove heat from the reactor 
cavity, without any external motive force, is one of the design characteristics that make the 
PBMR and inherently safe design. 
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Figure 3.5 Side View of Reactor Cavity 
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Chapter 4 Preliminary Casualty Analysis 



The goal of any reactor designer is to have a final plant that produces safe and 
economical power. In order for a plant to be considered safe it must not pose a health risk 
to either the operators or the public. The primary concern for public safety is the release of 
radioactive contaminants from the reactor building to the surrounding environment. This 
chapter discusses the possible causes of fission product release from the PBMR and 
identifies the specific casualties for which deterministic analysis is performed. 

4.1 Causes for Fission Product Release 

All of the paths through which fission products could be released require multiple 
elements in the reactor design to fail. The possible means of fission product release are 
best described by a diagram. Figure 4.1 is a Master Logic Diagram for a notional nuclear 
reactor. As can be seen in the diagram the causes for fission product release are: 

• Coolant Inventory Excursion 

• Reactivity Excursion 

• Temperature Excursion 

• Pressure Excursion 

Figure 4.1 is applicable for a light water reactor [ 1]. The casualties that can cause 
fission product release must cause damage to the fuel, escape of fission products from the 
primary pressure boundary, and escape of the fission products from the containment 
building. The same holds true for the PBMR. However, due to the design of the PBMR 
reactor design, damage to the fuel from high temperatures is unlikely. The high 
temperature characteristics of the fuel (see Figure 3.3) result in the vessel reaching its 
melting point long before the fuel exceeds a temperature where fission product release is 
likely. 
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Figure 4.1 Master Logic Diagram 
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For this research the initiating event of the casualty is assumed to be a beyond 
design basis earthquake. The possible consequences for this event are evaluated. Some of 
the possible casualties during an earthquake are: loss of all electrical power (normal and 
backup), incapacitation of operators, rupture of helium coolant system, collapse of 
building, and rupture of cooling systems. Casualties are chosen for analysis to determine if 
they will result in fission product release. Analysis by Eskom has shown that a 
Depressurized Loss of Coolant (DPLOC) casualty would not result in fuel damage [5]. 

The total collapse of the building is deemed unlikely. A reactivity excursion would not 
result from an earthquake due to the reactivity control and shutdown system. The fuel 
could be damaged by chemical attack if water or air entered the core, but neither of these 
casualties is likely due to the plant design. 

The PBMR relies on the proper operation of the RCCS in order to remove decay 
heat that is generated in the core following the reactor scram. Impairing the operation of 
the RCCS is a possible cause of mechanical failure of the reactor vessel. Normally, the 
PBMR transfers its heat to the RCCS via radiation and convection heat transfer. Thermal 
analysis of the reactor shows that the fuel will not be damaged prior to vessel failure due to 
the high temperature characteristics of the fuel. However, catastrophic failure of the 
reactor vessel could result in fuel damage due to mechanical shock, thermal shock, or 
chemical attack. The deterministic portion of this research deals with two possible 
methods by which the passive decay heat removal of the PBMR could be impaired. 

4.2 Description of the Chosen Casualties 

For the first casualty the following is a sequence of events that are assumed to 
occur for which the deterministic analyses are applicable. First a loss of all electrical 
power occurs. Then reactor scrams. Operators at the plant are incapacitated. A rupture of 
one of the RCCS tubes occurs in the reactor cavity. This rupture sprays water onto the 
reactor vessel which is initially at 279 "C. This water flashes to steam. Steam fills the 
reactor cavity. The steam displaces air in the reactor cavity. Radiation heat transfer from 
the reactor vessel to the RCCS cylinders is reduced by the steam in the gap between the 





vessel and RCCS. This reduction in heat transfer results in higher vessel temperatures that 
under normal operations. 

The first deterministic analysis deals with determining the effect water vapor has 
on the overall heat transfer out of the reactor vessel. This is a casualty that has not been 
analyzed for by Eskom. Figure 4.2 is a flowchart of how the decay heat is transferred 
through the reactor and to the surrounding RCCS cylinders. The effect of having a 
damaged RCCS subsystem is shown. In Chapter 6 the effect on vessel temperature of the 
steam is shown to be negligible. 

The second casualty chosen for analysis also involved the RCCS. Without pumps 
running the RCCS system operates by transferring decay heat to water in the cylinders. 

The water boils off and is vented from the reactor cavity area. The cylinder temperatures 
stay at approximately 100 °C, while the water is boiling off. The water in the cylinders can 
remove a great deal of heat from the reactor vessel without exceeding design temperature 
limits. The PBMR SAR states that the RCCS system should operate in the boil off mode 
for 3 days before it ceases to function due to loss of water. If the water is not replenished 
by operators the system ceases to function and vessel temperatures can start to rise. The 
second casualty determines the effect of operators failing to refill the RCCS. 

The PBMR reactor vessel is made of SA 508 mild steel. Yield strength and 
modulus of elasticity of carbon steel vary with temperature. At elevated temperatures (> 
600 ®C) the yield strength is greatly reduced. Rupture of the vessel and subsequent 
damage to the fuel is possible if vessel temperature becomes too high. Fission products 
can then be released from the fuel and reactor. The rupture causes the pressure in the 
reactor cavity to rise and the pressure relief systems associated with the citadel complex 
will be actuated. The initial relief of the helium prior to fuel damage removes the primary 
motive force that could transport the radionuclides which are formed from damaged fuel. 






Rupture in a RCCS Cooling 
Chamber during an Earthquake 



Figure 4.2 Damaged RCCS Casualty Flowchart 






















Chapter 5 Deterministic Methods Used 


This chapter describes the methods used to analyze the casualty response of the 
notional PBMR. First the HEATING finite element analysis program is described. Next 
the heat transfer model used in the analysis is described. The analytical equations used in 
the heat transfer model are explained. Finally, a description of the reactor vessel structural 
equations is given. The notional PBMR is referred to as simply the PBMR in this and the 
following chapters. 

5.1 Description of HEATING 

The heat transfer analysis program used in this research was developed by Oak 
Ridge National Labs. A detailed description of the program can be found in reference [7]. 
“HEATING is a general-purpose conduction heat transfer program written in Fortran 77. 
HEATING can solve steady-state and/or transient heat conduction problems in one-, two-, 
or three-dimensional Cartesian, cylindrical or spherical coordinates. A model may include 
multiple materials, and the thermal conductivity, density, and specific heat of each material 
may be both time- and temperature-dependent. The thermal conductivity may also be 
anisotropic. Materials may undergo change of phase. Thermal properties of materials may 
be input or may be extracted from a material properties hbrary. Heat-generation rates may 
be dependent on time, temperature, and position and boundary temperatures may be time 
and position dependent. The boundary conditions, which may be surface-to-environment 
or surface-to-surface, may be specified temperatures or any combination of prescribed heat 
flux, forced convection, natural convection, and radiation. The boundary condition 
parameters may be time- and/or temperature- dependent. General graybody radiation 
problems may be modeled with user-defined faetors for radiant exchange. The mesh 
spacing may be variable along each axis. HEATING uses a run- time memory allocation 
scheme to avoid having to recompile to match memory requirements for each specific 
problem. HEATING utilizes free-form input.” [7]. 

This work uses the finite element program to model the PBMR reactor cavity and 
its surroundings with cylindrical and cylindrical shell regions. HEATING has advantages 






and disadvantages for these analyses. The advantage is that most of the components being 
modeled are actually cylindrical in shape. Unfortunately, HEATING can not account for 
the movement of fluid or conservation of mass. This limitation is a problem when the 
RCCS cylinders, which are filled with boiling water, are being analyzed. It is not possible 
to accurately simulate the boiling and mixing of water in the cylinders and the loss of mass 
due to boil off of the water. In one portion of this analysis, this limitation is overcome by 
using the total heat transfer between the reactor and RCCS to estimate the time at which 
sufficient water is boiled off to render the RCCS inoperable. 


5.2 PBMR Heat Transfer Model 


The reactor cavity is assumed to be surrounded by soil. This assumption was made 
in order to ease calculations. Because of the very slow heat transfer rate, the lower 
boundary of this model is assumed to be 26.63 m. There are 26 regions in the model. The 
total number of nodes in the model is 2342. Figures 5. la and 5. lb are diagrams of the 
different regions of the heat transfer model. 

• 

Initial equilibrium cycle core conditions obtained from the VSOP code were 
assumed to exist at the t im e of shutdown. Table 5.1 shows the initial conditions used for 
the model. Where the temperature is spatially dependent, the figures that display them are 
® identified in the table. The core modeled was the Eskom pebble-bed reactor being 

proposed in South Africa, which is being used by MIT as the reference core design. The 
KFA decay heat curve was assumed. 

* Table 5.1 PBMR Model Initial Conditions 


Region 

Initial Temperature (°C) 

The Core 

Figure 5.2 

Top Reflector 

Figure 5.3 

Side Reflector 

Figure 5.4 

Helium Gap 

279 

Pressure Vessel 

279 

Air Gap 

150 

RCCS 

100 

Concrete Wall 

50 

Earth 

35 


25 

























Figure 5.1a PBMR Heat Transfer Model Regions 
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Figure 5.1b Detaileci View of Heat Transfer Regions 
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Figure 5.2 Initial Temperature of Core Regions 










Figure 5.3 Initial Temperature of the Upper Helium Gap and Top Reflector 
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Figure 5.4 Initial Temperature of the Side Reflector 




The core barrel region, which is made of steel of small thickness and high thermal 
conductivity relative to the other materials, is neglected because of its low thermal 
resistance. For the steam blanketing casualty, several data runs are conducted for various 
conditions in the gap between the reactor vessel and the boundaries. The goal for this 
portion of the analysis is to determine the effect water vapor in the reactor cavity has on 
the maximum fuel and vessel temperatures. 

Decay Heat Generation 

After reactor shutdown, fission power induced by delayed neutrons subsides 
rapidly and thereafter, the heat released by radioactive decay of fission products dominates 
the reactor power. The decay heat depends primarily on the operating history of the 
reactor, including the reactor power level prior to shutdown, and on the duration of the 
shutdown period. The following empirical formula from is used to approximate the power 
released by radioactive decay [8]: 


Qdh(^o> ts)—QTMh to + ts) (5.1) 

Where: 

Or = reactor power prior to shutdown, 
ts = reactor shutdown time, 
to = reactor operating time, and 

A and a are constants given for different time intervals in Table 4.3. 

Table 5.2 Constants A and a in Eq. (5.1) 


Time Intervals (seconds) 

A 

a 


0.0603 

0.0639 

10‘<ts<1.5*10^ 

0.0766 

0.181 


0.130 


4.0*10'’<ts<2.0*10" 

0.266 

0.335 


Figure 5.5 displays the decay heat curve with respect to time after shutdown. The power 
curves for the 5 core regions are shown in Figure 5.6. 

























Power Density Factor (Region Power over 
Average Power Density) 



Figure 5.6 Power Densities of the Core Regions 
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The material properties used in this analysis are obtained from various sources [9, 
10, 11, 12]. The properties required for input into the finite element analysis program are: 
specific heat, density, and conductivity. The values for some of these properties vary with 
temperature. Tabular values are entered into the input file so that the various material 
regions can be modeled properly. HEATING uses linear interpolation to determine values 
of properties between tabular input points. For the heat transfer calculations the RCCS 
was assumed to be a constant 100 °C for one of the casualties. 

5.3 Radiation Heat Transfer 

The modeling of radiation heat transfer through the gap between the reactor vessel 
and the RCCS cylinders was the most difficult portion of this analysis. Several methods 
were tried before a final analytical technique was chosen. Radiation heat transfer is the 
primary means by which heat is removed from the core. Convection heat transfer was 
found to be significant at normal operating temperatures but less significant at higher 
vessel temperatures. Conduction through the gap was found to be very small. Models in 
which only conductivity was used to cool the core showed that vessel and fuel 
temperatures exceeded design limits. This was due to the low densities in the gap between 
the reactor vessel and the RCCS cylinders. The total heat transfer through the gap was 
found by combining the calculated heat fluxes from radiation, convection, and conduction. 

The radiation heat transfer through the gap was analyzed for various mixtures of 
steam and air. Air was effectively transparent to thermal radiation for this size of gap (.9 
meters) between the RCCS cylinder and the reactor vessel. The amount of radiation 
transferred between two gray surfaces without the interference of an absorbing gas in 
between them is found using the following [11, 12]: 


1 

■- + — 

2 J [ s.. 


Where: 


q^t: Heat Flux (W/m^) 

Evessei: Black Body Radiation of Vessel (W/m^) 
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Erccs'- Black Body Radiation of RCCS (W/m^) 

Evessei: Vessel Surface Emissivity 
Erccs: RCCS Surface Emissivity 

Blackbody radiation is found using the following equation 

EBu.caoi,=<^^T* (5-3) 

Where: 

o: Stephan-Boltzmann Constant (5.67*10 * W/ m^K^) 

T: Surface Temperature (K) 

Steam is not transparent to thermal radiation. Therefore the heat transferred from 
the vessel to the RCCS cylinders varies with the amount of steam in the gap. The radiation 
heat transfer is affected by changes in the emissivity of the steam in the gap. Figure 5.7 is 
a graph of the total emissivity versus temperature for various pressure-thicknesses of steam 
[11]. The pressure-thickness is a measure of the amount of steam radiation must pass 
through. For this analysis the maximum pressure of water vapor was assumed to be 1 
atmosphere, i.e. the reactor cavity is completely filled with steam. The pressure relief 
system for the citadel actuates at pressures slightly above atmospheric. The actuation of 
this system combined with the fact that other gases will always be present in the reactor 
cavity results in a maximum pressure thickness of .9 atmosphere-meters of water vapor, 
since the approximately .9 metes. 

The steam attenuates some of the thermal radiation from the reactor vessel. 
Reference [12] discusses the radiation transferred between parallel plates through a gray 
gas. Figure 5.8 is a graph that shows the effective heat transfer between two blackbodies 
with respect to the optical thickness of the slab of gray gas between them. The optical 
thickness for the steam in the gap is one half of its emissivity. This graph is equally valid 
for determining the radiation heat transfer between gray surfaces. Therefore, in order to 
determine the effective heat transferred, the heat flux calculated using equation 5.3 is 
multiplied by the appropriate attenuation factor. This factor is found by using the 
corresponding total flux line of Figure 5.8 for the optical thickness of the water vapor in 
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Figure 5.8 Net Radiative Flux through a Gray Gas [^ 2 ] 

As is discussed elsewhere in this report, the effect of steam on RCCS performance 
was found to be relatively small. The casualty of operators failing to refill the RCCS uses 
a different approach to perform the heat transfer analysis. The RCCS is assumed to stay at 
100 °C until the system ceased to function at approximately three days. Instead of using 
analytical solutions to solve for the heat flux and then specifying the heat flux to the finite 
element program, a radiation heat transfer coefficient is determined. This heat transfer 
coefficient is used in the finite element model to determine the radiation heat flux off of the 
vessel. The two methods used for analyzing the radiation heat flux have very similar 
results. The second method used to calculate the radiation heat flux from the vessel to the 
cylinders is [7]: 

q” = hr* (Tvessel^ - TrcCS^) * (Tvessel " TrcCS ) (5.4) 

Where: 

q”: Heat Flux (W/m^) 

Tvessei: Reactor Vessel Temperature 
Trccs: RCCS Cylinder Temperature 
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hr: Radiative Heat Transfer Coefficient 


K =■ 


l/fi+(A,/A2)(l/f2-l) 


(5.5) 


Where: 

a: Stephan-Boltzmann Constant (5.67* 10‘* W/m^K*) 
ei: Higher Temperature Surface Emissivity 
£ 2 : Lower Temperature Surface Emissivity 
Ai: Higher Temperature Surface Area (m^) 

A 2 : Lower Temperature Surface Area (m^) 


5.4 Natural Convection between Vessel and RCCS 


The natural convection heat transfer between the reactor vessel and the surrounding 
water-filled RCCS cylinders is affected by the composition of the mixture in the gap 
between the two surfaces. The RCCS system consists of 45 cylinders and the gaps 
between cylinders is bridged with a thermal shield. The natural circulation in this region is 
driven by the vessel being significantly higher that the RCCS cylinder. The resulting flow 
is up along the reactor vessel surface then down along the RCCS. In order to enable an 
analytical solution to be found the RCCS is modeled as a flat cylindrical shell. 

There are two non-dimensional numbers that are important when evaluating natural 
convection between two surfaces: Rayleigh number and Nusselt number. The Rayleigh 
number is the non-dimensional relation between buoyancy and viscosity forces. The 
Nusselt number is the non-dimensional heat transfer. For a cylinder surrounded by a 
cylindrical shell the equations for the Rayleigh and Nusselt numbers are [11]: 

_ g B(7;-rjL ^ 
y-a 

Nu = 0.09 Ra-^’* ^ (1/H)° ‘^^(Di/L) ln(Do/Di) 

Where: 

Ra: Rayleigh number 
g: gravitational constant (9.81 m/s^) 

Tj: temperature of inner surface 


(5.6) 

(5.7) 






To: temperature of outer surface 
B: coefficient of thermal expansion 
L: characteristic length: L = (Do-Di)/2 = .8 meters 
v: kinematic viscosity 
H: height of cylinders 

The validity for Nusselt number equation is valid for the ranges: Ra<10^, 2 < 
(Do/Di) < 15,1 < H/L < L. For the problem of convection heat transfer between the reactor 
vessel and the RCCS cylinders the following relations apply: 


H/L =12.5 
Do/Di=1.27 
Ra = 510*-210^ 

The Rayleigh number is well beyond the valid range for the Nusselt number 
equation. The range is exceeded due to the fact that the gap between the two surfaces is 
relatively small; which results in a small difference in surface area. The values for 
convective heat transfer were using this method were much lower than those calculated by 
the Eskom. A more appropriate way to solve for the heat transfer is treat the two surfaces 
as parallel plates, due to the small difference in surface area. The Nusselt number for this 
case is [10]: 



(5.8) 


Where: 

Pr: Prandtl number 

The Prandtl number is determined from the physical properties of the mixture in the 
gap between the two surfaces. All properties for this mixture are evaluated at the mean 
temperature of the two surfaces. The RCCS is assumed to have a fixed temperature of 100 
°C since this is the boiling point of the water in the RCCS. The Nusselt number is used to 
determine the heat transfer coefficient for the two surfaces then the natural circulation heat 





Nu-L 

k 


^conv ~ 


hconv '( Tvessel-TRCCS) 


(5.9) 

(5.10) 


Where: 

qconv: convective heat flux between vessel and RCCS (W/m^) 
k: thermal conductivity of mixture in gap 

hconv- convective heat transfer coefficient 

The convection and radiation heat fluxes are combined with the conduction heat 
flux to give the total heat flux from the vessel to the RCCS. This heat flux is used as an 
input for the vessel region defined in the HEATING finite element analysis. It is then 
possible to determine the response of the PBMR for various mixtures of steam and air in 
the gap between the vessel and the RCCS cylinders by varying the physical properties used 
in the calculations. 


5.5 Effect of Steam on the Heat Transfer out of the Reactor 
Vessel 

Steam is not transparent to thermal radiation and therefore reduces the amount of 
heat transfer out of the vessel. This reduction in heat transfer results in elevated core and 
vessel temperatures. This section details the effect of changing the percentage of steam in 
the gap on the total heat flux out of the vessel. The heat flux out of the vessel is calculated 
for ten different values of vessel temperature. AU of the physical and thermal properties 
of the mixture in the gap were found using the average temperature of the vessel and the 
RCCS. 


Table 5.3 shows the conduction heat flux values. Table 5.4 contains the values for 
convective heat flux. Table 5.5 Usts the radiation heat flux between the vessel and the 
RCCS. The values for the combined heat flux are given in Table 5.6. The values of heat 
flux are determined for steam with concentrations of: 100,75, 50, 25, and 0 percent. 





Table 5.3 Conduction Heat Flux out of Vessel 



Concentration of Steam 


1 

0.75 

0.5 

0.25 

0 

Temperature 

Heat Flux 

Heat Flux 

Heat Flux 

Heat Flux 

Heat Flux 

CO 

(w/m^) 

(w/m^) 

(w/m^) 

(w/m^) 

(w/m^ 

279 

6.46 

6.86 

7.26 

7.659 

8.059 

350 

10.333 


11.37 

11.888 

12.406 

450 

16.29 


17.579 

18.224 

18.869 

550 

23.413 

24.065 

24.717 

25.369 

26.021 

650 

31.543 

32.104 

32.665 

33.226 

33.787 

750 

40.643 

41.025 

41.408 

41.79 

42.172 

850 

51.047 

51.047 

51.047 

51.047 

51.047 

950 

62.445 

61.944 

61.443 

60.942 

60.441 

1050 

75.154 

73.945 

72.735 

71.526 

70.317 

1150 

89.38 

87.259 

85.139 

83.019 

80.898 


Table 5.4 Convection Heat Flux out of Vessel 



Concentration of Steam 


1 

0.75 

0.5 

0.25 

0 

Temperature 

(“C) 

Heat Flux 
(w/m^) 

Heat Flux 
(w/m^) 

Heat Flux 
(w/m^) 

Heat Flux 
(w/m^) 

Heat Flux 
(w/m^) 

279 

288.767 

293.508 

298.27 

302.869 

307.127 

350 

431.07 

437.102 

443.244 

449.264 

454.933 

450 

653.353 

658.724 

664.337 

669.885 

675.052 

550 

885.068 

888.266 

891.926 

895.701 

899.216 

650 

1.12E+03 

1.12E+03 

1.12E+03 

1.12E+03 

1.12E+03 

750 

1.36E+03 

1.36E+03 

1.35E+03 

1.35E+03 


850 

1.63E+03 

1.61E+03 

1.60E+03 

1.58E+03 

1.56E+03 

950 

1.89E+03 

1.86E+03 

1.83E+03 

1.81E+03 

1.78E+03 

1050 

2.24E+03 

2.18E+03 

2.12E+03 

2.06E+03 

2.00E+03 

1150 

2.72E+03 

2.59E+03 

2.47E+03 

2.34E+03 

2.21 E+03 











































































































































Table 5.5 Radiation Heat Flux out of Vessel 



Concentration of Steam 


1 

0.75 

0.5 

0.25 

0 

Temperature 

Heat Flux 

Heat Flux 

Heat Flux 

Heat Flux 

Heat Flux 

ro 

(w/m^) 

(w/m^) 

(w/m^) 

(w/m^) 

(w/m^) 

279 

2.04E+03 

2.09E+03 

2.17E+03 

2.30E+03 

2.55E+03 

350 

3.65E+03 

3.74E+03 

3.88E+03 

4.11E+03 

4.56E+03 

450 

7.06E+03 

7.24E+03 

7.50E+03 

7.94E+03 

8.83E+03 

550 

1.22E+04 

1.25E+04 

1.30E+04 

1.38E+04 

1.53E+04 

650 

1.97E+04 

2.01 E+04 

2.09E+04 

2.21 E+04 

2.46E+04 

750 

2.99E+04 

3.07E+04 

3.18E+04 

3.37E+04 

3.74E+04 

850 

4.37E+04 

4.48E+04 

4.64E+04 

o 

+ 

LU 

CM 

CD 

5.46E+04 

950 

6.17E+04 

6.32E+04 

6.55E+04 

6.94E+04 

7.71 E+04 

1050 

8.47E+04 

8.68E+04 

9.00E+04 

9.53E+04 

1.06E+05 

1150 

1.14E+05 

1.16E+05 

1.21 E+05 

1.28E+05 

1.42E+05 


Table 5.6 Total Heat Flux out of Vessel 



Concentration of Steam 

1 

0.75 

0.5 

0.25 

0 

Temperature 

ro 

Heat Flux 
(w/m^) 

Heat Flux 
(w/m^ 

Heat Flux 
(w/m^) 


Heat Flux 
(w/m^) 

279 

2.34E+03 

2.39E+03 

2.48E+03 

2.61 E+03 

2.87E+03 

350 

4.09E+03 

4.19E+03 

4.33E+03 

4.57E+03 

5.03E+03 

450 

7.73E+03 

7.91 E+03 

8.18E+03 

8.63E+03 

9.52E+03 

550 

1.31 E+04 

1.34E+04 

1.39E+04 

1.47E+04 

1.62E+04 

650 

2.08E+04 

2.13E+04 

2.20E+04 

2.33E+04 

2.57E+04 

750 

3.13E+04 

3.21 E+04 

3.32E+04 

3.51 E+04 

3.88E+04 

850 

4.54E+04 

4.65E+04 

4.81 E+04 

5.08E+04 

5.62E+04 

950 

6.36E+04 

6.51 E+04 

6.74E+04 

7.13E+04 

7.89E+04 


8.70E+04 

8.90E+04 

9.22E+04 

9.74E+04 

1.08E+05 

1150 

1.16E+05 

1.19E+05 

1.23E+05 

1.30E+05 

1.44E+05 


















































































































































5.6 Structural Analysis of Reactor Vessel 


Elevated vessel temperatures which exceed the design temperature limit can result 
in damage to the vessel. The PBMR vessel is made out of S A-508, which is mild steel. 
These material properties of mild steel vary with temperature. Specifically, the yield 
strength is greatly reduced above 600 °C. Table 5.7 is a summary of the mechanical and 
thermal properties of mild steel. 

Table 5.7 Mechanical and Thermal Properties of Mild Steel 


Temp 

"C 

Yield 

Stress 

(Mpa) 

Young’s 

Modulus 

(Cpa) 

Poisson's 

Ratio 

Thermal 

Exp. 

Coefficient 
(10®/“C 

0 

290 

200 

0.3 

10 

100 

260 

200 

0.3 

11 

300 

200 

200 

0.3 

12 

450 

150 

150 

0.3 

13 

550 

120 

110 

0.3 

14 

600 

110 

88 

0.3 

14 

720 

9.8 

20 

0.3 

14 

800 

9.8 

20 

0.3 

15 

1550 

0.98 

0.2 

0.3 



The highest temperature on the modeled vessel is found at its vertical center. This 
region is called the beltline. As the temperature increases the modulus of elasticity and 
yield strength are reduced. If the vessel temperature is high enough the foUowing 
sequence of events could occur: 

1. Temperature increases due to impairment of the RCCS. 

2. Yield strength decreases and plastic deformation starts and can lead to a rupture 
in the beltline region. 

3. The rupture results in the internal pressure equalizes with external pressure. 
Citadel over-pressure system actuates removing the helium from the reactor 
cavity and PCU space. The Citadel consists of the reactor cavity and PCU 
spaces. 






4. Pressure stress drops rapidly. The weight of the upper vessel head and vessel 
cylindrical shell create a compressive stress: 

• If the compressive stress exceeds the yield stress the vessel will plastically 
deform around the point of fracture. 

• This compressive stress can cause the vessel to buckle if it exceeds the 
critical buckling stress of the vessel. 

5. Catastrophic failure of the vessel can result in mechanical/thermal shock and/or 
chemical attack of the fuel pebbles. 

6. Damage to fuel causes fission products to be released to the reactor cavity. 

7. Fission products escape the citadel via the pressure relief system as 
compartment temperatures rise and cause cavity pressure to increase. 

The reactor vessel is a cylindrical with elliptical upper and lower heads. The 
internal pressure following a reactor scram is 4.8 MPa. As the core temperature increases 
the pressure will rise due to expansion of the helium gas. The maximum vessel stress is 
calculated from a combination of circumferential and tensile stresses. The equations that 
determine the pressure stress in the vessel are [15]. 

ax p 

(5.11) 


ax p 
2xh 


(5.12) 


>/3 axp 

~2 JT 


(5.13) 


Where: 

Oe®: circumferential stress 
Oxx: axial stress 
h: thickness 

a: average radius 

p: pressure 









The maximum stress for the vessel is then found and compared to the yield 
strength. If the maximum stress exceeds the yield strength of the vessel material plastic 
deformation occurs and a rupture is possible. The internal pressure equalizes with the 
external pressure when the vessel ruptures. 

Once the pressure equalizes, the stress in the wall becomes compressive due to the 
weight of the upper vessel. The compressive stress is found by dividing the weight of the 
upper portion of the vessel by the cross-sectional area of the shell. Using this method the 
maximum compressive stress is found to be 1.2 MPa. The vessel is then analyzed to 
determine if it will buckle. Reference [16] discusses cylindrical vessels in compression 
from an axial force. In order to determine the stress at which the buckling will occur we 
use the following equations [16]: 



Eh 

a-yjs-il-v) 


(5.14) 
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0 . 6 -- 10 -’- 
h 


a 


1 + 0.004- 


yield 


(5.15) 


Where: 

<Tcr: Critical Stress 
Ouit: Ultimate Stress 
Oyieid: Yield Stress 
v: Poisson’s Ratio 

The critical stress equation is an analytical solution using the Euler method. Test 
results have shown that vessels in axial compression fail at stress levels well below the 
critical stress. The ultimate stress equation is based on empirical results, and more 
• accurately predicts the vessel behavior. The effects of vessel temperature on the structural 

response of the PBMR are discussed further in the next chapter. 
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Chapter 6 Results of the Analysis 


In order for probabilities of failure to be assigned to the proposed casualty the 
effects of the casualty are determined. The first casualty being analyzed is a rupture in a 
passive cooling system (RCCS) for the PBMR. This rupture generates steam due to the 
cooling water splashing on the hot reactor vessel. As discussed in chapter 5, steam in the 
gap reduces the amount of radiation heat transfer from the vessel to the RCCS. The second 
casualty analyzed was failure of the RCCS due to operator inaction. The operators failing 
to refill the RCCS casualty is shown to be a much more limiting case than steam 
blanketing casualty. This chapter summarizes the results of the heat transfer analysis for 
both casualties. Finally, the structural response of the vessel to the temperature transient is 
discussed. 

6.1 Thermal Response Analysis Results 
Steam Blanketing 

This analysis section deals with the effect that steam blanketing of the reactor 
vessel has on its passive heat removal. The HEATING model of the PBMR was used to 
predict the response of the plant to various concentrations of water vapor in the gap 
between the reactor vessel and the RCCS cooling cylinders. The results of these analyses 
are shown in Figures 6.1-6.10. The water vapor concentrations used in the analysis are: 
100,75, 50, 25, and 0 percent. 

The effect on the water vapor on the passive heat removal of the reactor vessel is 
not as great as initially expected. With the gap filled completely with steam the radiation 
heat flux is reduced hy 20 percent. The presence of Steam results in a maximum vessel 
temperature increase of 32 °C above the maximum vessel temperature with only air 
present. Figure 6.11 is a graph of maximum core temperature versus time for aU the 
different gap mixtures. Figure 6.12 is a graph of the vessel temperature with respect to 
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Distributions w/ no Steam in the Annular 
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Figure 6.2 Axial Vessel Temp. Distributions w/ no Steam in the Annular Region 
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Figure 6.3 Radial Temp. Distributions w/ 25% Steam in the Annular Region 
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Figure 6.4 Axial Vessel Temp. Distributions w/ 25% Steam in the Annular Region 
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Figure 6.5 Radial Temp. Distributions w/ 50% Steam in the Annular Region 














Figure 6.6 Axial Vessel Temp. Distributions w/ 50% Steam in the Annular Region 
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Figure 6.8 Axial Vessel Temp. Distributions w/ 75% Steam in the Annular Region 
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Distributions w/100% Steam in the Annular Region 
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Figure 6.11 Maximum Core Temperatures vs. Time 


57 








58 











RCCS Failure due to Operator inaction 


# 


m 



The effect of steam in the reactor cavity is shown to be relatively small. The 
second casualty more directly impairs the operation of the RCCS. The system will stop 
removing heat from the reactor cavity when a significant amount of the water in the tubes 
has been evaporated. Operators can prevent this failure by adding water to the system. 
Operators not taking the proper action could be the result of either operator error or lack of 
operator access to the facility. 

This casualty assumes that no operator action is taken and the RCCS completely 
fails at three different times. The amount of time prior to RCCS failure is determined by 
comparing the heat flux transferred from the reactor vessel to the RCCS. This heat causes 
the water in the tubes to boil off. Therefore, various volumes of water boiling off are 
associated with the amount of time it took to evaporate them. At approximately 3 days 70 
percent of the water is evaporated. The actual response of the system would be a gradual 
reduction in the rate of heat transfer. The exact time that the RCCS ceases to function is 
unknown. For this reason three different start times for the casualty are analyzed: 72 
hours, 87 horns, and 100 hours. 

First the response of the PBMR is determined assuming no failure of the RCCS. 
The cylinders of the RCCS are assumed to stay at 100 °C. At the start of the casualty the 
boundary conditions of the inner gap between the RCCS and the vessel are changed. The 
RCCS cylinders are allowed to heat up and conduct heat to the outer gap between the 
RCCS and the cavity wall. The material properties of the models RCCS region are 
modified to simulate the fact that heat from the vessel is conducted around the 
circumference of the RCCS cylinders and then radiated to the walls of the cavity. Figures 
6.13-20 show the temperature responses of the reactor vessel and the entire reactor cavity 
model to the casualty for the four cases: RCCS functioning, failure at 72 hours, failure at 
87 hours, and failure at 100 hours. Figure 6.21 is a graph of the maximum core and vessel 
temperatures for the four cases. We see that excessive vessel temperatures result in all the 
cases for a failed RCCS. 
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Figure 6.13 Vessel Temperature with RCCS Functioning 
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Figure 6.14 Reactor Cavity Radial Temperature Profile with RCCS Functioning 
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Figure 6.16 Reactor Cavity Radial Temperature Profile with RCCS Failing at 72 Hours 
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Figure 6.17 Vessel Temperature with RCCS Failing at 87 Hours 
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Figure 6.18 Reactor Cavity Radial Temperature Profile with RCCS Failing at 87 Hours 
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Figure 6.19 Vessel Temperature with RCCS Failing at 87 Hours 
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Figure 6.20 Reactor Cavity Radiai Temperature Profile with RCCS Failing at 100 Hours 







Maximum Core and Vessel Temperatures for the Four Cases 













Discussion of the Thermai Analysis Results 



The two previous sections dealt with the results of the thermal analysis of the 
PBMR for the two different casualties. Both of these casualties involve interfering with 
the inherent heat removal capability of the Reactor Cavity Cooling System. The steam 
blanketing case is shown to have little effect on the safety of the plant. The second 
casualty results in direct impairment of the RCCS due to operators failing to replenish the 
systems supply of water. The cases are not analyzed beyond the 222 hour point. In all 
cases with a failed RCCS the temperatures in the RCCS cylinders are high enough to cause 
their mechanical failure. This failure would have resulted in a change in the reactor cavity 
configuration; therefore, analysis beyond 222 hours is deemed not useful 

6.2 Results of PBMR Structural Analysis 

Section 5.6 discusses how vessel stress is calculated. As the vessel temperature 
increases two things happen. The helium inside the reactor vessel undergoes thermal 
expansion and compresses the rest of the helium in the attached piping resulting in a 
pressure increase. Also, the yield strength and modulus of elasticity of the vessel material 
decreases as the vessel temperature increases. 

Following the scram, the initial pressure in the PBMR is 4.8 MPa. This pressure 
increases as the temperature of the helium in the vessel rises. Correspondingly, the stress 
caused by the internal pressure increases. The reactor vessel will fail when this stress 
reaches the yield point of the vessel material. Figure 6.22 is a graph that shows the 
decreasing yield strength plotted against temperature. Plastic deformation begins when the 
yield strength reaches the vessel stress. The core temperature in the analysis was relatively 
independent of the vessel temperature. The majority of the pressure increase in the plant 
occurs as the core temperature rises to its maximum value. This increase in pressure 
happens before the vessel temperature starts to rise in the casualties evaluated. The 
estimated maximum pressure in the vessel is 6.5 MPa. This pressure results in a maximum 
stress of 115 MPa. The pressure stress and the SA 508 yield stress intersect at 
approximately 500 °C. 
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Figure 6.22 Yield Stress versus Temperature of Vessel Material 









The ductile failure of the vessel will eventually lead to a rupture in the pressure 
boundary. As described in the previous chapter, the possibility of buckling was also 
examined. Figure 6.23 is a graph of the critical and ultimate stresses which will result in 
buckling and the maximum compressive stress due to the vessel weight. The maximum 
compressive stress is less than the ultimate stress up to well above 1,000 °C. Therefore, 
buckling is deemed not to occur in the PBMR. 

When the RCCS system is allowed to expend its water supply without additional 
water being added, the vessel temperatures are shown to rise to above 900 °C. The strain 
rates of vessel material also increase with the vessel temperature. Fracture will result from 
the increased vessel temperature. This fracture will release the helium and reduce the 
vessel internal pressure. The vessel stress will become compressive. Ductile failure will 
likely continue near the point of fracture and the vessel will possibly collapse since the 
fracture will act as a stress concentrator. 







1.00E+10 



Figure 6.23 Bucking Stress in PBMR Vessel 





Chapter 7 Probabilistic Assessment of PBMR Casualties 


The two casualties analyzed in Chapters 5 and 6 yield very different results. The 
steam blanketing casualty is shown not to be of concern for the safety of the PBMR. 
Inaction by operators to refill the RCCS is shown to have detrimental effects on the 
Reactor Unit. Temperatures of the vessel are high enough to possibly cause catastrophic 
failure of the pressure vessel. This casualty can therefore result in the release of fission 
products due to damage of the fuel pebbles. This chapter deals with assigning probabilities 
to these casualties so that an overall judgment can be made. In an official risk-based 
analysis these probabilities would be assigned by establishing a commission to discuss 
each event in the fault tree. For this work, the author assigned the event probabilities after 
consultation with members of the Nuclear Engineering Department of the Massachusetts 
Institute of Technology. 

7.1 Steam Blanketing 

The addition of steam to the reactor cavity does not significantly alfect the 
operation of the PBMR decay heat removal system. The cavity being completely filled 
with steam results in a 20 percent reduction in graybody radiation heat transfer. This 
reduction in radiation heat transfer leads to a 32 “C temperature rise on the vessel. This 
temperature rise is not enough to cause damage to the reactor vessel. Therefore, the 
probability that this casualty will result in fission product release is assigned a value of 
zero. 

7.2 Probability of the RCCS failing due to Operator Inaction 

The Reactor Cavity Cooling System can operate for approximately three days 
without being filled with water if it’s in a no flow condition. A large earthquake could 
knock out the electrical power to the primary and backup pumps for the RCCS. The 
probability of this occurrence is associated with the likelihood of an earthquake of 
sufficient size occurring in the vicinity of the power plant. The probability of this 
occurrence is lE-4/year. 
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For this casualty to have an effect on the PBMR safety; operators must not add 
water to the RCCS for at least 100 hours. The first variable in this casualty is the time 
required for operators to take the correct actions. The operators could fail to take the 
appropriate actions for one of two reasons. First, the earthquake could have rendered 
aceess to the PBMR site or RCCS piping impossible. Seeond, the operators could take 
improper actions relating to the RCCS. The longer it takes for operators to respond 
correctly, the higher the possibility of damage to the PBMR vessel. Another variable in 
the analysis is the time at which the RCCS ceases to function with enough capacity to 
remove the decay heat generated in the core. Chapter 6 details the results of the three 
different initiation times for complete failure of the RCCS. In reality the failure would be 
more gradual, but Figure 6.22 shows that the results are nearly the same for the three 
different eases just shifted in time. 

Due to analysis of how much energy is required to boil the water in the RCCS the 
probability that the system fails before 72 hours is deemed to be very low. After 72 hours 
the probability the system failing would increase due to the fact that there is a fixed 
amount of water in the eooling cylinders. The mean value for the time that the RCCS 
ceases to function is assigned a value of 87 hours. The initial rupture of the system should 
oecur before the vessel reaches 700 °C since at this temperature the pressure stress is 10 
times higher that the yield stress. Using Figures 6.21 and 6.22 a mean time for the 
eatastrophic failure of the vessel is estimated to be 185 hours, which corresponds to an 
850 °C vessel temperature. In order to prevent the catastrophic failure of the vessel the 
operators must respond before this time. Therefore the probability of this event is based on 
the likelihood that operators will not respond properly ini85 hours. It should be noted that 
this time estimate eould be greatly improved by more accurate mechanieal property data 
for the vessel material and testing of stress concentrations in a ruptured cylindrical shell. 
The probability of the operators not acting in time is lE-3. 

The next event that needs to occur is that the fuel pebbles must be damaged in 
order for fission products to be released. Several factors affect the possibility of this event. 
Following the failure of the vessel the fuel could be damaged by mechanical shock, 
thermal shock, or chemical attack. All of these events are likely if there is a catastrophic 




failure of the reactor vessel. The probability of fuel damage is therefore given a 
probability of 0.75 if the vessel has failed. 

The final event that must occur is that the fission products are transferred out of the 
PBMR containment area. The fission products could be entrained with helium in the 
cavity and carried out very the pressure relief system. The relief system could have failed 
open dining the vent off of the hehum. The rupture disc in the vent pipe could have blown 
and its protective valve failed open. Any of these occurrences could result in fission 
product release to the environment. The probability of this event occurring assuming that a 
large earthquake has already occurred is 0.001. 

The probability of fission product release is obtained by combining all the 
probabilities above. The calculated probability for this casualty affecting the surroundings 
is therefore 7.5E-11/year. This probability would be combined with all the other possible 
casualties that could lead to fission product release to the environment. These other 
casualties would have to be analyzed and assigned the appropriate probabilities of 
occurrence. 
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Chapter 8 Conclusions and Future Work 


The purpose of this work was to analyze the PBMR reactor to determine if its 
inherently safe design warranted use of a non-standard containment system. This 
determination was to be based on the probability of fission product release for casualties 
which impaired the decay heat removal capability of the reactor. The initiating event for 
both of the casualties was a beyond design basis earthquake. 

The first casualty was steam blanketing of the Reactor Unit by water released from 
a ruptured RCCS cylinder. The deterministic analysis portion of this work showed that the 
reduction in radiation heat transfer due to the presence of water vapor was negligible, and 
had no effect on reactor safety. The second casualty was the loss of the RCCS due to 
operators not replenishing the water. This event resulted in vessel temperatures in excess 
of 900 °C. If proper action was not taken within a given amount of time catastrophic 
failure of the reactor vessel could occur. The likelihood of this event was assessed to be 
7.5E-11/year. This risk would be combined with the risk of all the other possible 
occurrences that could result in fission product release to obtain the total risk to the pubhc. 
The analysis in this work has shown that the Eskom assertion of the PBMR not requiring a 
standard containment system is justified for the evaluated casualties. 

Here are some recommendations for further analysis into risk based licensing of the 
PBMR. Future efforts should be directed into further identifying casualties that are 
specific to PBMR reactor design. A Computational Fluid Dynamics program should be 
used in foUow-on analysis to overcome the limitations of HEATING. A group of experts 
should be involved in assigning the probabilities to the individual components of the 
casualty risk analysis. 
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Appendix A: RCCS Addition Information [5] 


The purpose of the RCCS is to transfer to the sea (or to the atmosphere, when the sea water 
system is not available), the heat from the reactor cavity during all modes of reactor 
operation, including a Pressurized or Depressurized Loss of Forced Cooling (PLOFC or 
DLOFC) event, thereby protecting the concrete wall of the cavity, and ensuring that the 
maximum Reactor Pressure Vessel (RPV) and fuel temperatures are not exceeded. 

Natural processes, for instance, thermal radiation and convection, transport the heat from 
the reactor vessel walls to the cooling chambers of the cavity cooling system. 

The RCCS is a three-loop system of large water chambers surrounding the reactor. Heat 
absorbed by the water is pumped to plate heat exchangers where it is transferred to the 
UHSS. The UFCS is a water-cooled system operating in parallel with the RCCS, and using 
the same pumps and heat exchangers as the RCCS. Water can be directed to either the 
RCCS or the UFCS, or to both, and both are backed-up by the cooling towers. Both can 
operate in passive mode when required. 

The UFCS consists of an annular tank with a water jacket. Decay heat from the fuel is 
transferred to the water in the jacket, the hot water then being pumped to the RCCS heat 
exchangers. 

The RCCS is designed to remove the specified waste heat from the reactor cavity under all 
operating conditions. It is a water-based system made up of proven plate heat exchangers, 
pumps, valves and pipework. All operating pumps have standby units which will 
automatically come on line in the event of a failure of an operational unit. Valves are 
generally kept in the open position, being closed manually for maintenance purposes. 

In addition to having back-up cooling towers, the RCCS has a passive mode of operation 
in that water contained in these systems can be allowed to boil off over a period of 
approximately three days, sufficient to allow the fuel heat to decay to a safe level. 
Additional water from an outside source can also be introduced to replenish water lost 
through evaporation. The period of three days is based on 50% of the water boiling away, 
the heat load being 1 100 kW as expected under DLOFC conditions. 
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The systems are fitted with temperature, pressure and level indicators, and facilities are 
available for extracting samples on a regular basis. 

All components of the RCCS and UFCS have a design pressure rating of 1 MPa, while 
operating pressures are not expected to exceed 0.5 MPa. 

The schematic layout of the RCCS and UFCS is shown in the figure on the next page. The 
RCCS consists of three identical cooling trains, where each train is an independent, low- 
pressure, closed-loop, pump-driven, water-based cooling system 

Within the reactor cavity, the system consists of a series of 45 low carbon steel water 
chambers, each approximately 500 mm in diameter and 22 m long, arranged vertically 
around, and concentric to, the RPV. The chamber wall thickness is 10 mm. Three 150 mm 
diameter inlet and three outlet headers are arranged around the top of the chambers. Each 
outlet header transports hot water to a heat exchanger situated outside the reactor cavity, 
after which it is pumped back into the corresponding inlet header. From each inlet header, 
feed lines enter the top of every third chamber, then run down the inside of the chamber to 
discharge cold water at the bottom. 

The entire chamber structure is suspended from a support ring resting on the concrete wall 
of the reactor cavity, thereby allowing free expansion and contraction. Anti-syphoning 
devices are fitted to prevent the chambers from being emptied in the event of a low-level 
break in the pipework outside of the reactor cavity, and the trains are connected to fixed 
water make-up lines fed fi'om the existing Koeberg facilities. 

Each cooling train has its own plate heat exchanger and two 100% pumps. These are 
situated on the -19 m level of the Module Building. The three trains are backed up by two 
50% cooling towers situated on the roof of the module. Each tower has two 100% main 
circulating pumps and two 100% spray pumps. 






